aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer
AgeCommit message (Collapse)Author
2012-04-01Analyzer: Store BugReports directly in a ilist instead of adding another ↵Benjamin Kramer
layer of inderection with std::list git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153847 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-30[analyzer]Malloc,RetainRelease: Allow pointer to escape via NSMapInsert.Anna Zaks
Fixes a false positive (radar://11152419). The current solution of adding the info into 3 places is quite ugly. Pending a generic pointer escapes callback. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153731 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-30[analyzer] Do not inline functions which previously reached max blockAnna Zaks
count. This is an optimization for "retry without inlining" option. Here, if we failed to inline a function due to reaching the basic block max count, we are going to store this information and not try to inline it again in the translation unit. This can be viewed as a function summary. On sqlite, with this optimization, we are 30% faster then before and cover 10% more basic blocks (partially because the number of times we reach timeout is decreased by 20%). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153730 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-28[analyzer] Enable retry exhausted without inlining by default.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153591 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-28[analyser] Stats checker: do not mark a node as exhausted if we willAnna Zaks
retry without inlining. (+ other minor cleanups) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153581 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-28[analyzer] Refactor: Use Decl when determining if the Block belongs toAnna Zaks
the root function. (This is a bit cleaner then using the StackFrame.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153580 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-28Fix suspicious comparison reported by PVS-Studio!Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153568 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-27[analyzer] Add an option to re-analyze a dead-end path without inlining.Anna Zaks
The analyzer gives up path exploration under certain conditions. For example, when the same basic block has been visited more than 4 times. With inlining turned on, this could lead to decrease in code coverage. Specifically, if we give up inside the inlined function, the rest of parent's basic blocks will not get analyzed. This commit introduces an option to enable re-run along the failed path, in which we do not inline the last inlined call site. This is done by enqueueing the node before the processing of the inlined call site with a special policy encoded in the state. The policy tells us not to inline the call site along the path. This lead to ~10% increase in the number of paths analyzed. Even though we expected a much greater coverage improvement. The option is turned off by default for now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153534 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-27[analyzer] Stats checker: minor interprocedural tweaks.Anna Zaks
Report root function name with exhausted block diagnostic. Also, use stack frames, not just any location context when checking if the basic block is in the same context. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153532 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-27[analyzer] Stats: Only count the number of times we run path sensitiveAnna Zaks
analyzes. (This method can be called twice on the same function.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153531 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-27Change RetainCountChecker to eagerly "escape" retained objects when they areTed Kremenek
assigned to a struct. This is fallout from inlining results, which expose far more patterns where people stuff CF objects into structs and pass them around (and we can reason about it). The problem is that we don't have a general way to detect when values have escaped, so as an intermediate step we need to eagerly prune out such tracking. Fixes <rdar://problem/11104566>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153489 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-26[analyzer] Malloc: Allow a pointer to escape through OSAtomicEnqueue.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153453 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-24[analyzer] Tighten up the realloc() failure path note generation...make sure ↵Jordy Rose
we get the right realloc()! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153370 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-24[analyzer] Restart path diagnostic generation if any of the visitors change ↵Jordy Rose
the report configuration while walking the path. This required adding a change count token to BugReport, but also allowed us to ditch ImmutableList as the BugReporterVisitor data type. Also, remove the hack from MallocChecker, now that visitors appear in the opposite order. This is not exactly a fix, but the common case -- custom diagnostics after generic ones -- is now the default behavior. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153369 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-24[analyzer] Add a clone() method to BugReporterVisitor, so that we'll be able ↵Jordy Rose
to reset diagnostic generation. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153368 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-23Avoid applying retain/release effects twice in RetainCountChecker when a ↵Ted Kremenek
function call was inlined (i.e., we do not need to apply summaries in such cases). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153309 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-23corrected check::EndOfTranslationUnit checker name and added 'const' to ↵Anton Yartsev
declaration git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153302 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22Fix static analyzer crash on code taking the address of a field. Fixes PR ↵Ted Kremenek
11146. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153283 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22[analyzer] Add the stat for the number of successfully explored paths.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153281 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22[analyzer] Add stats useful for coverage investigations.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153280 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22[analyzer] Add inlining awareness to the block coverage computationAnna Zaks
(Stats Checker). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153279 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22"Teach" RetainCountChecker about dispatch_set_context, which can indirectly ↵Ted Kremenek
free its argument later. Fixes <rdar://problem/11059275>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153244 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-22[analyzer] Malloc: drop symbols captured by blocks.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153232 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-21Remove unused variable, fix indentation.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153220 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-21[analyzer] Malloc: Utter the name of the leaked variable.Anna Zaks
Specifically, we use the last store of the leaked symbol in the leak diagnostic. (No support for struct fields since the malloc checker doesn't track those yet.) + Infrastructure to track the regions used in store evaluations. This approach is more precise than iterating the store to obtain the region bound to the symbol, which is used in RetainCount checker. The region corresponds to what is uttered in the code in the last store and we do not rely on the store implementation to support this functionality. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153212 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-21[analyser] Factor out FindUniqueBinding from RetainCount checker.Anna Zaks
So that others could use it as well. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153211 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-18[analyzer] Mark a failed-realloc's result as an interesting symbol between ↵Jordy Rose
the realloc call and the null check, so we get nicer path notes. Fixes a regression introduced by the diagnostic pruning added in r152361. This is accomplished by calling markInteresting /during/ path diagnostic generation, and as such relies on deterministic ordering of BugReporterVisitors -- namely, that BugReporterVisitors are run in /reverse/ order from how they are added. (Right now that's a consequence of storing visitors in an ImmutableList, where new items are added to the front.) It's a little hacky, but it works for now. I think this is the best we can do without storing the relation between the old and new symbols, and that would be a hit whether or not there ends up being an error. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153010 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-18[analyzer] Use a FoldingSet to cache simple RetainSummary instances, rather ↵Jordy Rose
than explicitly keeping DoNothing and StopTracking summaries and nothing else. I tried to test the effects of this change on memory usage and run time, but what I saw on retain-release.m was indistinguishable from noise (debug and release builds). Even so, some caveman profiling showed 101 cache hits that we would have generated new summaries for before (i.e. not default or stop summaries), and the more code we analyze, the more memory we should save. Maybe we should have a standard project for benchmarking the retain count checker's memory and time? git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153007 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-17[analyzer] Unify retain-count summary generation for class and instance ↵Jordy Rose
methods. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153001 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-17[analyzer] Remove duplicate work on deriving method behavior. No ↵Jordy Rose
functionality change. The cocoa::deriveNamingConventions helper is just using method families anyway now, and the way RetainSummaryTemplate works means we're allocating an extra summary for every method with a relevant family. Also, fix RetainSummaryTemplate to do the right thing w/r/t annotating an /existing/ summary. This was probably the real cause of <rdar://problem/10824732> and the fix in r152448. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152998 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-17StaticAnalyzer: Fix abuse of StringRef in r152962.NAKAMURA Takumi
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152982 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-17[analyzer] Don't claim an object was returned with +1 retain count before ↵Jordy Rose
counting autoreleases. Fixes PR10376. (Also, 80-column violations.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152976 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-16[analyzer] Shorten the stack hint diagnostic.Anna Zaks
Do not display the standard "Returning from 'foo'", when a stack hint is available. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152964 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-16[analyzer] Create symbol-aware stack hints (building upon r152837).Anna Zaks
The symbol-aware stack hint combines the checker-provided message with the information about how the symbol was passed to the callee: as a parameter or a return value. For malloc, the generated messages look like this : "Returning from 'foo'; released memory via 1st parameter" "Returning from 'foo'; allocated memory via 1st parameter" "Returning from 'foo'; allocated memory returned" "Returning from 'foo'; reallocation of 1st parameter failed" (We are yet to handle cases when the symbol is a field in a struct or an array element.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152962 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-16[analyzer] +CommentsAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152961 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-16[analyzer] Add a statistic for the number of times we reach the maxAnna Zaks
number of steps in the work list. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152960 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-16Fix analyzer crash on analyzing 'catch' with no condition variable.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152900 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-15[analyzer] If a metadata symbol is interesting, its region is interesting as ↵Jordy Rose
well. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152868 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-15[analyzer] Remove AggExprVisitor, a dead class that assisted in visiting C++ ↵Jordy Rose
expressions with a "base object", because the CFG is now linearized. The only use of AggExprVisitor was in #if 0 code (the analyzer's incomplete C++ support), so there is no actual behavioral change anyway. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152856 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-15[analyzer] Allow checkers to supply call stack diagnostic hints for theAnna Zaks
BugVisitor DiagnosticPieces. When checkers create a DiagnosticPieceEvent, they can supply an extra string, which will be concatenated with the call exit message for every call on the stack between the diagnostic event and the final bug report. (This is a simple version, which could be/will be further enhanced.) For example, this is used in Malloc checker to produce the ", which allocated memory" in the following example: static char *malloc_wrapper() { // 2. Entered call from 'use' return malloc(12); // 3. Memory is allocated } void use() { char *v; v = malloc_wrapper(); // 1. Calling 'malloc_wrappers' // 4. Returning from 'malloc_wrapper', which allocated memory } // 5. Memory is never released; potential memory leak git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152837 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-14'#if 0' out a variable that's only used in other preprocessor-disabled code.Matt Beaumont-Gay
(Why are we keeping all of this code around anyway? Say the word and I'll start swinging the delete hammer.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152749 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-14[analyzer] Diagnostics: Supply Caller information even if the bug occursAnna Zaks
in the callee. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152734 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-14[Analyser] Remove unnecessary recursive visits for ExprWithCleanups andErik Verbruggen
MaterializeTemporaryExpr. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152730 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-14[Analyser] Removes more recursive visitations in ExprEngine that are noErik Verbruggen
longer needed as the CFG is fully linearized. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152720 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-13[analyser] Refactor shouldInline logic into a helper.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152677 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-13[analyzer] Call enter/exit diagnostic should refer to caller/callee,Anna Zaks
respectively. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152676 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-13[analyzer] Change the order in which we analyze the functions underAnna Zaks
inlining to be the reverse of their declaration. This optimizes running time under inlining up to 20% since we do not re-analyze the utility functions which are usually defined first in the translation unit if they have already been analyzed while inlined into the root functions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152653 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-13[analyzer] Use BFS over call graph when analysing functions.Anna Zaks
BFS should give slightly better performance. Ex: Suppose, we have two roots R1 and R2. A callee function C is reachable through both. However, C is not inlined when analyzing R1 due to inline stack depth limit. With DFS, C will be analyzed as top level even though it would be analyzed as inlined through R2. On the other hand, BFS could avoid analyzing C as top level. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152652 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-13[analyzer] Refactor CallGraph to use Recursive AST visitor whenAnna Zaks
collecting function Decls. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152651 91177308-0d34-0410-b5e6-96231b3b80d8
2012-03-13[analyzer] Use recursive AST visitor to drive simple visitation order inAnna Zaks
AnalysisConsumer. As a result: - We now analyze the C++ methods which are defined within the class body. These were completely skipped before. - Ensure that AST checkers are called on functions in the order they are defined in the Translation unit. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152650 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-07-07 09:17:48 +0000